In the operation of cryptosystems such as public key infrastructures (PKIs), a certificate authority (CA) functions as a trusted third party. The CA issues digital certificates certifying the holding party. This allows other parties to rely on assertions or signatures made by the certificate holder. For this system to work, both the certificate holder and the party relying upon the certificate must trust the CA.
Over time, a CA revokes some issued certificates for various reasons. The CA maintains a certificate revocation list (CRL) of the certificates that have been revoked. When an application verifies a party holding a certificate, the application checks to ensure that the certificate is not on the CRL (i.e., has not been revoked). A party presenting a revoked certificate should not be trusted. To check the CRL, the verifying party uses as an address (typically a URL) in the certificate itself, which points to a CRL distribution point (CDP), at which the CRL resides. The field in the certification which holds this address is called the CDP extension. Using the CDP extension, the verifying application retrieves the CRL from the CDP, and checks the CRL to determine whether the presented certificate has been revoked.
CAs issue large numbers of certificates over time (e.g., thousands, tens of thousands). Conventionally, each certificate issued by the same CA contains the same CDP extension, which points to a single CRL. The CDP extension in an issued certificate cannot be changed unless the certificate is replaced. As the same CA issues more certificates, the CRL grows over time. A Large CRL results in decreased performance by verifying applications, due to the bandwidth and computational resources required to download and process the large list.
It would be desirable to address these issues.